Method and system for authorizing industrial computer applications based on Android system

Abstract

The present invention discloses an industrial computer application authorization method and system based on the Android system, relating to the technical field of industrial computers, including: preliminary classification of applications and setting authorization levels; marking public applications based on the Android system and adjusting authorization levels; marking applications for exceptions and adjusting authorization levels of applications that have been marked for exceptions. The present invention is used to solve the problem in existing industrial computer application authorization methods that when an application is accessed multiple times or there are many users accessing it at the same time, the application may experience abnormal phenomena such as read-write conflicts, write-write conflicts, deadlocks or livelocks due to the multi-threaded sharing of resources in the application, thereby causing large user access delays or application failures, which affect the actual user experience.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial control computers, and in particular to an Android-based industrial control computer application authorization method and system. Background Art

[0002] An industrial computer (IC) is a bus-structured computer system designed specifically for industrial environments. It is used to monitor and control production processes, electromechanical equipment, and process equipment. IPC applications primarily include PLC programming software, SCADA systems, HMI software, data acquisition and processing software, data analysis and modeling software, database management systems, and embedded programming tools. These applications together constitute the IPC software ecosystem, supporting the design, development, and operation and maintenance of industrial automation and control systems.

[0003] The existing method for authorization of industrial computer applications is usually to perform an authorization check on the application, assign a value to the authorization status environment variable based on the authorization status of the application, and authorize access to the application in the protected state based on the authorization status environment variable of the application, thereby realizing access protection of the application in terms of authorization. Although this improved method can protect the access of the application when it is accessed, when the application is accessed multiple times or there are many users accessing it at the same time, the application may experience abnormal phenomena such as read-write conflicts, write-write conflicts, deadlocks or livelocks due to the multi-threaded sharing of resources in the application, thereby causing problems such as large user access delays or application non-response, which affect the actual user experience. For example, in the patent application with publication number CN117851990A, a method based on LD_PRE LOAD's application authorization method, system, electronic device and medium, this solution is to check the authorization status environment variable before the application accesses the resource in a protected state. If the value of the authorization status environment variable indicates that the application is not authorized, the application is denied access to the resource, otherwise the application is allowed to access the resource. Other improvements for industrial computer application authorization are usually improvements to improve authorization accuracy, but still cannot solve the problem that when the application is accessed multiple times or there are many users accessing it at the same time, the application will have read-write conflicts, write-write conflicts, deadlocks or livelocks due to the multi-threaded sharing of resources in the application, resulting in large user access delays or application failures, which affect the user's actual experience. In view of this, it is necessary to improve the existing industrial computer application authorization method. Summary of the Invention

[0004] The present invention aims to solve at least one of the technical problems in the prior art to a certain extent. By proposing an industrial computer application authorization method and system based on the Android system, it is used to solve the problem in the existing industrial computer application authorization method that when the application is accessed multiple times or there are many users accessing it at the same time, the multi-threaded shared resources of the application will cause the application to have abnormal phenomena such as read-write conflicts, write-write conflicts, deadlocks or livelocks, thereby causing large user access delays or application failures, which affect the user's actual experience.

[0005] To achieve the above objectives, in a first aspect, the present application provides an Android-based industrial computer application authorization method, comprising the following steps:

[0006] Obtaining applications from the industrial computer and preliminarily classifying the applications based on the application access settings and administrator settings, wherein the applications in the industrial computer are classified into public applications, regular authorized applications, and administrator authorized applications; and setting authorization levels for the preliminarily classified applications based on the Android system;

[0007] Monitor applications with set authorization levels in real time, record the data obtained from the real-time monitoring as real-time monitoring data, and mark public applications based on the real-time monitoring data; adjust the authorization level of the marked public applications based on the Android system;

[0008] Acquire the change data of the authorization level of the application in real time, and mark the application as abnormal based on the change data of the authorization level of the application; and adjust the authorization level of the application marked as abnormal.

[0009] Furthermore, obtaining the applications in the industrial computer and preliminarily classifying the applications based on the access settings and administrator settings of the applications include:

[0010] Obtain all applications in the industrial computer, obtain the access settings and administrator settings of all applications, and perform preliminary classification of all applications;

[0011] The preliminary classification includes: applications whose access rights are set to public in the access settings are recorded as public applications; applications whose access objects require authorized access in the access settings are recorded as authorized applications. The access settings are the access rights set for the access objects when the application is created. The access rights include public and authorized access.

[0012] Based on the administrator settings, the authorized applications that are only accessible to the administrator are recorded as administrator-authorized applications, and the authorized applications that can be accessed by users other than the administrator are recorded as regular-authorized applications. The administrator settings are the settings of the access rights by the administrator when the application is created.

[0013] Furthermore, the Android system sets authorization levels for the preliminarily classified applications, including:

[0014] Set the authorization level of public applications to normal permissions based on the Android system;

[0015] The Android system sets the authorization level of regular authorization programs to dangerous permissions;

[0016] Based on the Android system, the authorization level of the administrator authorization program is set to privileged permission.

[0017] Furthermore, real-time monitoring of applications for which authorization levels have been set, recording data obtained from the real-time monitoring as real-time monitoring data, and marking public applications based on the real-time monitoring data include:

[0018] Monitor the execution status of applications with authorization levels set by the Android system in real time and obtain real-time monitoring data; analyze the real-time monitoring data using public program analysis methods and mark public applications based on the analysis results;

[0019] The public application analysis method includes: for any public application, recording the time that the public application has been monitored in the real-time monitoring data as T; establishing a spatial coordinate system and recording it as the co-visit analysis coordinate system, wherein the X-axis unit of the co-visit analysis coordinate system is minutes, the Y-axis is a constant axis, and the Z-axis unit is milliseconds;

[0020] Based on real-time monitoring data, the number of users accessing the public application and the access delays of users accessing the public application are obtained. For any time point t when the public application is monitored in the real-time monitoring data, the users accessing the public application at time point t are recorded as co-visiting users, and the number of co-visiting users is recorded as n. The sum of the access delays of all co-visiting users accessing the public application at time point t is recorded as k.

[0021] Furthermore, the open program analysis method also includes:

[0022] The point with coordinates (t, n, k) in the co-visit analysis coordinate system is recorded as the co-visit analysis point at time point t; the co-visit analysis points corresponding to all time points within the monitoring time of the public application in the real-time monitoring data are obtained, and the curve obtained by fitting all the co-visit analysis points is recorded as the co-visit curve, and the number of co-visit analysis points is recorded as q;

[0023] For any point A on the co-visit curve, the co-visit analysis method is used to obtain the co-visit analysis value of point A. The co-visit analysis method includes: drawing a perpendicular line from point A to the X-axis, recording the length of the perpendicular line as L, recording the sine of the acute angle formed by the perpendicular line and the XY plane as u; and recording the value of u / L as the co-visit analysis value of point A.

[0024] Furthermore, the open program analysis method also includes:

[0025] Obtain the point with the largest co-visit analysis value in the co-visit curve and record it as point M. Use the co-visit analysis method to obtain the co-visit analysis values corresponding to all co-visit analysis points, and record the co-visit analysis point corresponding to the co-visit analysis value with the smallest difference from the co-visit analysis value of point M among all the co-visit analysis values as the high delay point.

[0026] Furthermore, the open program analysis method also includes:

[0027] The delay analysis method is used to obtain the high delay ratio of the high delay point. The delay analysis method includes: marking the horizontal coordinate of the high delay point as r, and marking the delay of the co-visiting user corresponding to the high delay point to access the public application at time point r as r1 to r c , where c is the number of co-visiting users corresponding to the high delay point;

[0028] The access delay of the public application under standard conditions is recorded as r st , change r1 to r c Greater than r st The number is recorded as z, and the ratio of z to c is recorded as the high delay ratio;

[0029] Continuously obtain real-time monitoring data of public applications that has been monitored for a period greater than T, and record it as identifiable data; obtain co-access analysis points of public applications in the identifiable data, and record them as identification analysis points; when the high delay ratio of any identification analysis point is greater than the high delay ratio of the high delay point, mark the public application as a to-be-restricted application, and record the number of co-access users corresponding to the high delay point as the restriction number;

[0030] When the obtained high-delay ratios of all the identified analysis points are less than or equal to the high-delay ratio of the high-delay point, the public application is not marked.

[0031] Furthermore, the Android system adjusts the authorization level of the marked public application, including:

[0032] For any application α that has been marked as a pending application, use the Android system to set the authorization level of application α to dangerous permissions, and adjust application α from a public application to a regular authorization application, wherein the approval condition for application α's access in the dangerous permission is set to the maximum number of users who can access application α at the same time;

[0033] Based on real-time monitoring data, the latest identification analysis point in the identifiable data of application α is obtained. When the high delay ratio corresponding to the identification analysis point is less than or equal to the high delay ratio of the high delay point, the identification analysis point is recorded as a delay optimization point; when the latest q identification analysis points of application α are all recorded as delay optimization points, the Android system is used to set the authorization level of application α to normal permissions, and application α is adjusted to a public application.

[0034] Furthermore, obtaining the change data of the authorization level of the application in real time and marking the application as abnormal based on the change data of the authorization level of the application; adjusting the authorization level of the application marked as abnormal includes:

[0035] Obtain the change data of the authorization level of each application in real time, and initially set the authorization points of each application to 0; when the authorization level of any public application α is adjusted from ordinary permission to dangerous permission, the authorization points of public application α are increased by 1; when the existence of any regular authorization program β changes, the authorization points of regular authorization program β are increased by 1;

[0036] Whenever the real-time acquisition time of the authorization level change data of an application is greater than T, the application with the maximum authorization points and an authorization point greater than 0 is marked as an abnormal fluctuation program, and the real-time acquisition time of the authorization level change data of the application is reset;

[0037] The authorization level of the abnormal fluctuation program is set to privileged authority, the abnormal fluctuation program is adjusted to an administrator-authorized program, and the administrator monitors the access status of the abnormal fluctuation program in real time.

[0038] Secondly, this application also provides an industrial computer application authorization system based on the Android system, including an authorization initialization module, an authorization status analysis module, and an authorization adjustment module;

[0039] The initial authorization module is used to obtain applications in the industrial computer and preliminarily classify the applications based on the application access settings and administrator settings; and set the authorization level for the preliminarily classified applications based on the Android system;

[0040] The authorization status analysis module is used to monitor applications with set authorization levels in real time, record the data obtained from real-time monitoring as real-time monitoring data, and mark public applications based on the real-time monitoring data; and adjust the authorization level of the marked public applications based on the Android system;

[0041] The authorization adjustment module is used to obtain the change data of the authorization level of the application in real time, and mark the application as abnormal based on the change data of the authorization level of the application; and adjust the authorization level of the application that has been marked as abnormal.

[0042] Beneficial effects of the present invention: The present application first obtains the applications in the industrial computer, and preliminarily classifies the applications based on the access settings of the applications and the administrator settings; sets the authorization level for the preliminarily classified applications based on the Android system; then monitors the applications for which the authorization level has been set in real time, records the data obtained from the real-time monitoring as real-time monitoring data, and marks the public applications based on the real-time monitoring data. The advantage of this is that by preliminarily classifying the applications and setting the authorization level for the applications based on the Android system, the authorization level of the applications can be effectively refined, thereby providing different levels of access rights to applications with different access statuses to achieve protection of the applications, and marking the public applications based on the real-time monitoring data can obtain relevant data on the public applications that have been accessed multiple times or by a large number of users accessing at the same time, which leads to large access delays. This helps to adjust the authorization level of the public applications in subsequent analysis, thereby restricting access to the public applications, preventing abnormal phenomena caused by multi-threaded resource sharing of the applications, and avoiding problems that affect the actual user experience, such as large user access delays or application non-response.

[0043] This application also adjusts the authorization level of the marked public application based on the Android system; finally, obtains the change data of the authorization level of the application in real time, and marks the application as abnormal based on the change data of the authorization level of the application; adjusts the authorization level of the application that has been marked as abnormal. The advantage of this is that by marking the application as abnormal and adjusting the authorization level of the application that has been marked as abnormal, the access of the application can be restricted in time and staff can be intervened to manage it when there is an abnormality in the access status of the application, so as to prevent the application from crashing due to multi-threaded shared resource abnormalities. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a principle block diagram of the system of the present invention;

[0045] Figure 2is a flow chart of the steps of the method of the present invention;

[0046] Figure 3 Schematic diagram of obtaining the co-visit analysis value of the present invention;

[0047] Figure 4 A schematic diagram of the monitoring time axis of the present invention;

[0048] Figure 5 Schematic diagram of the structure of the electronic device of the present invention. DETAILED DESCRIPTION

[0049] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0050] Example 1, please refer to Figure 1 As shown, this application provides an industrial computer application authorization system based on the Android system, including an authorization initialization module, an authorization status analysis module, and an authorization adjustment module;

[0051] The initial authorization module is used to obtain applications in the industrial computer and preliminarily classify the applications based on the application access settings and administrator settings; and set the authorization level for the preliminarily classified applications based on the Android system;

[0052] The authorization initialization module includes a program level initialization unit, which is configured with a program level initialization strategy. The program level initialization strategy includes:

[0053] Obtain all applications in the industrial computer, obtain the access settings and administrator settings of all applications, and perform preliminary classification of all applications;

[0054] The preliminary classification includes: applications whose access rights are set to public in the access settings are recorded as public applications; applications whose access objects require authorized access in the access settings are recorded as authorized applications. The access settings are the access rights set for the access objects when the application is created. The access rights include public and authorized access.

[0055] Based on the administrator setting, the authorized application that is only accessible to the administrator is recorded as the administrator-authorized application, and the authorized application that is accessible to users other than the administrator is recorded as the normal authorized application. The administrator setting is the access permission setting made by the administrator when the application is created.

[0056] In the specific implementation process, for example, in actual application, an application program in the industrial computer, such as PLC programming software, is set by the administrator to be accessible only to the administrator. In order to distinguish it from other applications and facilitate the setting of authorization levels later, the PLC programming software can be recorded as an administrator-authorized program, that is, the type of authorization level of the PLC programming software is indicated;

[0057] Set the authorization level of public applications to normal permissions based on the Android system;

[0058] The Android system sets the authorization level of regular authorization programs to dangerous permissions;

[0059] Based on the Android system, the authorization level of the administrator authorization program is set to privileged authority;

[0060] In the specific implementation process, setting the authorization level for the application based on the Android system can effectively refine the authorization level of the application, thereby providing different levels of access rights for applications with different access statuses to achieve protection of the application.

[0061] The authorization status analysis module is used to monitor applications with set authorization levels in real time, record the data obtained from real-time monitoring as real-time monitoring data, and mark public applications based on the real-time monitoring data; and adjust the authorization level of the marked public applications based on the Android system;

[0062] The authorization status analysis module includes an authorization status analysis unit, which is configured with an authorization status analysis strategy. The authorization status analysis strategy includes:

[0063] Monitor the execution status of applications with authorization levels set by the Android system in real time and obtain real-time monitoring data; analyze the real-time monitoring data using public program analysis methods and mark public applications based on the analysis results;

[0064] The public application analysis method includes: for any public application, recording the time that the public application has been monitored in the real-time monitoring data as T; establishing a spatial coordinate system and recording it as the co-visit analysis coordinate system, wherein the X-axis unit of the co-visit analysis coordinate system is minutes, the Y-axis is a constant axis, and the Z-axis unit is milliseconds;

[0065] In the specific implementation process, the actual value of T can be set according to the monitoring time of the public application in the real-time monitoring data. For example, in a subsequent analysis, if the public application is only monitored for one day in the real-time monitoring data, the value of T can be recorded as 1440 minutes, and then a co-visit analysis coordinate system can be established for analysis;

[0066] Based on the real-time monitoring data, the number of users accessing the public application and the access delays of users accessing the public application are obtained. For any time point t in the real-time monitoring data during which the public application is monitored, the users accessing the public application at time point t are recorded as co-visiting users, and the number of co-visiting users is recorded as n. The sum of the access delays of all co-visiting users accessing the public application at time point t is recorded as k.

[0067] The point with coordinates (t, n, k) in the co-visit analysis coordinate system is recorded as the co-visit analysis point at time point t; the co-visit analysis points corresponding to all time points within the monitoring time of the public application in the real-time monitoring data are obtained, and the curve obtained by fitting all the co-visit analysis points is recorded as the co-visit curve, and the number of co-visit analysis points is recorded as q;

[0068] In the specific implementation process, by obtaining co-access analysis points, it is possible to obtain points associated with the access time, the number of users accessing the public application, and the access delay of users accessing the public application at the same time, so as to analyze the access delay status when the application is accessed. Based on the analysis results, access to the public application can be restricted to prevent abnormal phenomena caused by multi-threaded resource sharing of the application, and avoid problems such as large user access delays or application non-response that affect the actual user experience;

[0069] For any point A in the co-visit curve, the co-visit analysis value of point A is obtained using the co-visit analysis method. The co-visit analysis method includes: drawing a perpendicular line from point A to the X-axis, and recording the length of the perpendicular line as L, and recording the sine value of the acute angle formed by the perpendicular line and the XY plane as u; the value of u / L is recorded as the co-visit analysis value of point A;

[0070] In the specific implementation process, for example, during a data analysis, the point A in the co-visit curve is obtained as follows: Figure 3 As shown by point A in Figure 3 It can be seen that line segment LL1 is a perpendicular line from point A to the X-axis, the length of line segment LL1 is L, and angle γ is the acute angle formed by line segment LL1 and the XY plane. The sine value of angle γ is calculated to be 0.5, so it can be calculated that the co-access analysis value of point A is 1 / 2L. By calculating the co-access analysis value, the relationship between the number of users accessing the public application corresponding to point A and the access delay of users accessing the public application can be integrated. The larger the co-access analysis value, the higher the access delay of users accessing the public application and the smaller the number of users accessing the public application corresponding to point A. In other words, the application at point A is greatly affected by multi-threaded resource sharing, which may cause access anomalies in the application. Therefore, in subsequent analysis, the point with the largest co-access analysis value in the co-access curve is obtained and further analyzed.

[0071] Obtain the point with the largest co-visit analysis value on the co-visit curve and record it as point M; use the co-visit analysis method to obtain the co-visit analysis values corresponding to all co-visit analysis points, and record the co-visit analysis point with the smallest difference from the co-visit analysis value of point M as the high delay point;

[0072] In a specific implementation process, for example, during a data analysis, the co-visit analysis value of point M is 0.12, and the co-visit analysis values of all co-visit analysis points are 0.01, 0.04, 0.1, 0.04, and 0.05, respectively. This means that the co-visit analysis point with a co-visit analysis value of 0.1 is closest to the co-visit analysis value of point M. Therefore, the co-visit analysis point with a co-visit analysis value of 0.1 can be recorded as a high-latency point for subsequent analysis.

[0073] The public application analysis method further includes: using a delay analysis method to obtain a high delay ratio of a high delay point, wherein the delay analysis method includes: marking the horizontal coordinate of the high delay point as r, and marking the delay of the co-visiting user corresponding to the high delay point accessing the public application at time point r as r1 to r1 in sequence. c , where c is the number of co-visiting users corresponding to the high delay point;

[0074] The access delay of the public application under standard conditions is recorded as r st , change r1 to r c Greater than r st The number is recorded as z, and the ratio of z to c is recorded as the high delay ratio;

[0075] In the specific implementation process, for example, during a data processing, the obtained r1 to r c They are 80ms, 94ms, 14ms, 45ms and 56ms respectively. st If the delay is 50ms, then the value of z is 3, and the value of c is 5, then the high delay ratio is 0.6;

[0076] The public application analysis method further includes: continuously obtaining real-time monitoring data of the public application for a period greater than T, and recording it as identifiable data; obtaining co-access analysis points of the public application in the identifiable data, and recording them as identification analysis points; when the high delay ratio of any identification analysis point is greater than the high delay ratio of the high delay point, marking the public application as a to-be-restricted application, and recording the number of co-access users corresponding to the high delay point as the restriction number;

[0077] In a specific implementation, for example, during a data analysis, if the high delay ratio of a high delay point is 0.6 and the high delay ratio of a screening analysis point is 0.7, it means that the access delay of users accessing the public application corresponding to the screening analysis point is generally larger and the ratio is larger than the ratio of the high delay point used for comparison. Therefore, by marking the public application as a to-be-restricted application and recording the number of co-visiting users corresponding to the high delay point as the restricted number, access to the public application is restricted, thereby achieving the purpose of protecting the public application;

[0078] When the obtained high-latency ratios of all the identified analysis points are less than or equal to the high-latency ratio of the high-latency point, the public application is not marked;

[0079] In the specific implementation process, for example, during a data analysis, the monitoring timeline of the real-time monitoring data for the public application is as follows: Figure 4 As shown, the time axis TT0 is the monitoring time axis of the real-time monitoring data for the public application; in actual analysis, a co-visit analysis coordinate system can be established for Figure 4 The real-time monitoring data in TT1 is analyzed and a high delay ratio is obtained. The real-time monitoring data in TT2 can be recorded as discriminable data and a discriminative analysis point can be obtained.

[0080] The authorization status analysis strategy further includes: for any application α that has been marked as a pending application, using the Android system to set the authorization level of the application α to dangerous permissions, and adjusting the application α from a public application to a regular authorization application, wherein the approval condition for the application α's access in the dangerous permissions is set to the maximum number of users who can access the application α at the same time;

[0081] Based on real-time monitoring data, the latest discriminative analysis point in the discriminable data of application α is obtained. When the high delay ratio corresponding to the discriminative analysis point is less than or equal to the high delay ratio of the high delay point, the discriminative analysis point is recorded as a delay optimization point. When all the latest q discriminative analysis points of application α are recorded as delay optimization points, the Android system is used to set the authorization level of application α to normal permissions and adjust application α to a public application.

[0082] During the specific implementation process, for example, during a data analysis, the value of q is 10. When the latest 10 identification and analysis points of application α are all recorded as delay optimization points, it means that the delay of application α when being accessed is generally low and maintained for a longer time. Therefore, the authorization level of application α can be set to normal permission, and the access restriction on application α has been lifted.

[0083] The authorization adjustment module is used to obtain the change data of the authorization level of the application in real time, and mark the application as abnormal based on the change data of the authorization level of the application; and adjust the authorization level of the application that has been marked as abnormal;

[0084] The authorization adjustment module includes a program authorization adjustment unit, which is configured with a program authorization adjustment policy. The program authorization adjustment policy includes:

[0085] Obtain the change data of the authorization level of each application in real time, and initially set the authorization points of each application to 0; when the authorization level of any public application α is adjusted from ordinary permission to dangerous permission, the authorization points of public application α are increased by 1; when the existence of any regular authorization program β changes, the authorization points of regular authorization program β are increased by 1;

[0086] In the specific process, by setting authorization points for applications, changes in the authorization levels of applications can be recorded, so that applications with large changes in authorization levels can be analyzed for abnormalities and connected to administrators for monitoring, preventing application crashes due to access anomalies;

[0087] Whenever the real-time acquisition time of the authorization level change data of an application is greater than T, the application with the maximum authorization points and an authorization point greater than 0 is marked as an abnormal fluctuation program, and the real-time acquisition time of the authorization level change data of the application is reset;

[0088] The authorization level of the abnormal fluctuation program is set to privileged authority, the abnormal fluctuation program is adjusted to an administrator-authorized program, and the administrator monitors the access status of the abnormal fluctuation program in real time.

[0089] Example 2, please refer to Figure 2 As shown, this application also provides an authorization method for an industrial computer application based on the Android system, including the following steps:

[0090] Step S1: Obtain applications in the industrial computer and preliminarily classify the applications based on the application access settings and administrator settings, wherein the applications in the industrial computer are classified into public applications, regular authorized applications, and administrator authorized applications; and set authorization levels for the preliminarily classified applications based on the Android system.

[0091] Step S1 includes: Step S101, obtaining all applications in the industrial computer, obtaining access settings and administrator settings of all applications, and preliminarily classifying all applications;

[0092] Step S102, preliminary classification includes: Step S1021, recording applications whose access rights in the access settings are public as public applications; recording applications whose access objects require authorized access in the access settings as authorized applications, wherein the access settings are the access rights set for the access objects when the application is created, and the access rights include public and authorized access;

[0093] Step S1022: Based on the administrator settings, the authorized applications that are only accessible to the administrator are recorded as administrator-authorized applications, and the authorized applications that can be accessed by users other than the administrator are recorded as regular-authorized applications. The administrator settings are the settings of the access rights by the administrator when the application is created.

[0094] Step S1 further includes: step S103, setting the authorization level of the public application to common authority based on the Android system;

[0095] Step S104: setting the authorization level of the conventional authorization program to dangerous permissions based on the Android system;

[0096] Step S105 : setting the authorization level of the administrator authorization program to a privileged authority based on the Android system.

[0097] Step S2: monitoring applications with set authorization levels in real time, recording data obtained from the real-time monitoring as real-time monitoring data, and marking public applications based on the real-time monitoring data; and adjusting the authorization level of the marked public applications based on the Android system;

[0098] Step S2 includes: step S201, real-time monitoring of the execution status of applications whose authorization levels are set by the Android system, and obtaining real-time monitoring data; analyzing the real-time monitoring data using a public program analysis method, and marking the public applications based on the analysis results;

[0099] Step S202, the public application analysis method includes: step S2021, for any public application, recording the time that the public application has been monitored in the real-time monitoring data as T; establishing a spatial coordinate system and recording it as a co-visit analysis coordinate system, wherein the unit of the X axis of the co-visit analysis coordinate system is min, the Y axis is a constant axis, and the unit of the Z axis is ms;

[0100] Step S2022: Based on the real-time monitoring data, the number of users accessing the public application and the access delays of the users accessing the public application are obtained. For any time point t in the real-time monitoring data during which the public application is monitored, the users accessing the public application at time point t are recorded as co-visiting users, and the number of co-visiting users is recorded as n. The sum of the access delays of all co-visiting users accessing the public application at time point t is recorded as k.

[0101] Step S2023: Record the point with coordinates (t, n, k) in the co-visit analysis coordinate system as the co-visit analysis point at time point t; obtain the co-visit analysis points corresponding to all time points within the monitoring time of the public application in the real-time monitoring data, record the curve obtained by fitting all the co-visit analysis points as the co-visit curve, and record the number of co-visit analysis points as q;

[0102] Step S2024: For any point A in the co-visit curve, a co-visit analysis method is used to obtain a co-visit analysis value for point A. The co-visit analysis method includes: drawing a perpendicular line from point A to the X-axis, recording the length of the perpendicular line as L, recording the sine of the acute angle formed by the perpendicular line and the XY plane as u; and recording the value of u / L as the co-visit analysis value for point A.

[0103] Step S2025: Obtain the point with the largest co-visit analysis value in the co-visit curve and record it as point M; use the co-visit analysis method to obtain the co-visit analysis values corresponding to all co-visit analysis points, and record the co-visit analysis point corresponding to the co-visit analysis value with the smallest difference from the co-visit analysis value of point M as the high delay point;

[0104] Step S2026, using a delay analysis method to obtain a high delay ratio of a high delay point, the delay analysis method includes: Step S20261, marking the horizontal coordinate of the high delay point as r, and marking the delay of the co-visiting user corresponding to the high delay point accessing the public application at time point r as r1 to r c , where c is the number of co-visiting users corresponding to the high delay point;

[0105] Step S20262: record the access delay of the public application in the standard state as r st , change r1 to r c Greater than r st The number is recorded as z, and the ratio of z to c is recorded as the high delay ratio;

[0106] Step S2027: Continuously obtain real-time monitoring data of the public application for a period greater than T, and record it as identifiable data; obtain co-access analysis points of the public application in the identifiable data, and record them as identification analysis points; when the high delay ratio of any identification analysis point is greater than the high delay ratio of the high delay point, mark the public application as a to-be-restricted application, and record the number of co-access users corresponding to the high delay point as the restriction number;

[0107] Step S2028: When the obtained high delay ratios of all the identified analysis points are less than or equal to the high delay ratio of the high delay point, the public application is not marked.

[0108] Step S203: For any application α that has been marked as a pending application, the Android system is used to set the authorization level of application α to dangerous permissions, and application α is adjusted from a public application to a regular authorization application. The approval condition for application α's access under the dangerous permissions is set to the maximum number of users who can access application α at the same time.

[0109] Step S204: Based on the real-time monitoring data, the latest identification and analysis point in the identifiable data of application α is obtained. When the high delay ratio corresponding to the identification and analysis point is less than or equal to the high delay ratio of the high delay point, the identification and analysis point is recorded as a delay optimization point. When the latest q identification and analysis points of application α are all recorded as delay optimization points, the Android system is used to set the authorization level of application α to normal permission, and application α is adjusted to a public application.

[0110] Step S3: obtaining the change data of the authorization level of the application in real time, marking the application as abnormal based on the change data of the authorization level of the application; and adjusting the authorization level of the application marked as abnormal.

[0111] Step S3 includes: Step S301, obtaining the change data of the authorization level of each application in real time, and initially setting the authorization points of each application to 0; when the authorization level of any public application α is adjusted from ordinary permission to dangerous permission, the authorization points of the public application α are increased by 1; when the existence of any regular authorization program β changes, the authorization points of the regular authorization program β are increased by 1;

[0112] Step S302: Whenever the real-time acquisition time of the authorization level change data of an application exceeds T, the application with the maximum authorization points and an authorization point greater than 0 is marked as an abnormal fluctuation application, and the real-time acquisition time of the authorization level change data of the application is reset;

[0113] Step S303 , setting the authorization level of the abnormal fluctuation program to privileged authority, adjusting the abnormal fluctuation program to an administrator-authorized program, and having the administrator monitor the access status of the abnormal fluctuation program in real time.

[0114] Example 3, please refer to Figure 5 As shown, Figure 5 A schematic diagram of the structure of an electronic device is provided. The electronic device may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The memory stores computer-readable instructions, and the processor can call the instructions in the memory. When the computer-readable instructions are executed by the processor, the steps of a method for authorizing industrial computer applications based on the Android system are executed to implement the following functions: first, obtaining applications from the industrial computer and preliminarily classifying the applications based on the application access settings and administrator settings; setting authorization levels for the preliminarily classified applications based on the Android system; then, monitoring the applications for which authorization levels have been set in real time, recording the data obtained from the real-time monitoring as real-time monitoring data, and marking public applications based on the real-time monitoring data; adjusting the authorization levels of the marked public applications based on the Android system; finally, obtaining real-time change data of the application authorization levels, marking the applications as abnormal based on the change data of the application authorization levels; and adjusting the authorization levels of the marked applications.

[0115] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program code.

[0116] Example 4. The present application also provides a computer-readable storage medium. The present application provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the industrial computer application authorization method based on the Android system are executed to achieve the following functions: first, the application in the industrial computer is obtained, and the application is preliminarily classified based on the access settings of the application and the administrator settings; the authorization level of the preliminarily classified application is set based on the Android system; then, the application with the set authorization level is monitored in real time, the data obtained by real-time monitoring is recorded as real-time monitoring data, and the public application is marked based on the real-time monitoring data; the authorization level of the marked public application is adjusted based on the Android system; finally, the change data of the authorization level of the application is obtained in real time, and the application is marked as abnormal based on the change data of the authorization level of the application; the authorization level of the application that has been marked as abnormal is adjusted.

[0117] Through the description of the above embodiments, the embodiments of the present invention can be provided as methods, systems, or computer program products. Based on this understanding, the essence of the above technical solutions or the portion that contributes to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for enabling a computer device (such as a personal computer, server, or network device) to execute the methods described in various embodiments or certain portions of the embodiments.

[0118] In the embodiments provided in this application, it should be understood that the disclosed system or method can be implemented in other ways. The embodiments described above are merely illustrative. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or units can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of systems, modules and units can be electrical, mechanical or other forms.

[0119] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. An industrial computer application authorization method based on the Android system is characterized in that: The steps include: Obtaining applications from the industrial computer and preliminarily classifying the applications based on the application access settings and administrator settings, wherein the applications in the industrial computer are classified into public applications, regular authorized applications, and administrator authorized applications; and setting authorization levels for the preliminarily classified applications based on the Android system; Monitor applications with set authorization levels in real time, record the data obtained from the real-time monitoring as real-time monitoring data, and mark public applications based on the real-time monitoring data; adjust the authorization level of the marked public applications based on the Android system; Acquire the change data of the authorization level of the application in real time, and mark the application as abnormal based on the change data of the authorization level of the application; adjust the authorization level of the application that has been marked as abnormal; Real-time monitoring of applications with set authorization levels, recording the data obtained from real-time monitoring as real-time monitoring data, and marking public applications based on the real-time monitoring data include: Monitor the execution status of applications with authorization levels set by the Android system in real time and obtain real-time monitoring data; analyze the real-time monitoring data using public program analysis methods and mark public applications based on the analysis results; The public application analysis method includes: for any public application, recording the time that the public application has been monitored in the real-time monitoring data as T; establishing a spatial coordinate system and recording it as the co-visit analysis coordinate system, wherein the X-axis unit of the co-visit analysis coordinate system is minutes, the Y-axis is a constant axis, and the Z-axis unit is milliseconds; Based on the real-time monitoring data, the number of users accessing the public application and the access delays of users accessing the public application are obtained. For any time point t in the real-time monitoring data during which the public application is monitored, the users accessing the public application at time point t are recorded as co-visiting users, and the number of co-visiting users is recorded as n. The sum of the access delays of all co-visiting users accessing the public application at time point t is recorded as k. The point with coordinates (t, n, k) in the co-visit analysis coordinate system is recorded as the co-visit analysis point at time point t; the co-visit analysis points corresponding to all time points within the monitoring time of the public application in the real-time monitoring data are obtained, and the curve obtained by fitting all the co-visit analysis points is recorded as the co-visit curve, and the number of co-visit analysis points is recorded as q; For any point A in the co-visit curve, the co-visit analysis value of point A is obtained using the co-visit analysis method. The co-visit analysis method includes: drawing a perpendicular line from point A to the X-axis, and recording the length of the perpendicular line as L, and recording the sine value of the acute angle formed by the perpendicular line and the XY plane as u; the value of u / L is recorded as the co-visit analysis value of point A; Obtain the point with the largest co-visit analysis value on the co-visit curve and record it as point M; use the co-visit analysis method to obtain the co-visit analysis values corresponding to all co-visit analysis points, and record the co-visit analysis point with the smallest difference from the co-visit analysis value of point M as the high delay point; Use the delay analysis method to obtain the high delay ratio value of the high delay point; The delay analysis method includes: marking the horizontal coordinate of the high delay point as r, and marking the delay of the co-visiting user corresponding to the high delay point accessing the public application at time point r as r1 to r c , where c is the number of co-visiting users corresponding to the high delay point; The access delay of the public application under standard conditions is recorded as r st , change r1 to r c Greater than r st The number is recorded as z, and the ratio of z to c is recorded as the high delay ratio; Continuously obtain real-time monitoring data of public applications that has been monitored for a period greater than T, and record it as identifiable data; obtain co-access analysis points of public applications in the identifiable data, and record them as identification analysis points; when the high delay ratio of any identification analysis point is greater than the high delay ratio of the high delay point, mark the public application as a to-be-restricted application, and record the number of co-access users corresponding to the high delay point as the restriction number; When the obtained high-delay ratios of all the identified analysis points are less than or equal to the high-delay ratio of the high-delay point, the public application is not marked.

2. The method for authorizing an industrial computer application based on an Android system according to claim 1, wherein: Obtaining applications from the industrial computer and preliminarily classifying them based on their access settings and administrator settings includes: Obtain all applications in the industrial computer, obtain the access settings and administrator settings of all applications, and perform preliminary classification of all applications; The preliminary classification includes: applications whose access rights are set to public in the access settings are recorded as public applications; applications whose access objects require authorized access in the access settings are recorded as authorized applications. The access settings are the access rights set for the access objects when the application is created. The access rights include public and authorized access. Based on the administrator settings, the authorized applications that are only accessible to the administrator are recorded as administrator-authorized applications, and the authorized applications that can be accessed by users other than the administrator are recorded as regular-authorized applications. The administrator settings are the settings of the access rights by the administrator when the application is created.

3. The method for authorizing an industrial computer application based on an Android system according to claim 2, wherein: The Android system sets authorization levels for applications that have been initially classified, including: Set the authorization level of public applications to normal permissions based on the Android system; The Android system sets the authorization level of regular authorization programs to dangerous permissions; Based on the Android system, the authorization level of the administrator authorization program is set to privileged permission.

4. The method for authorizing an industrial computer application based on an Android system according to claim 3, wherein: The Android system adjusts the authorization level of marked public applications, including: For any application α that has been marked as a pending application, use the Android system to set the authorization level of application α to dangerous permissions, and adjust application α from a public application to a regular authorization application, wherein the approval condition for application α's access in the dangerous permission is set to the maximum number of users who can access application α at the same time; Based on real-time monitoring data, the latest identification analysis point in the identifiable data of application α is obtained. When the high delay ratio corresponding to the identification analysis point is less than or equal to the high delay ratio of the high delay point, the identification analysis point is recorded as a delay optimization point; when the latest q identification analysis points of application α are all recorded as delay optimization points, the Android system is used to set the authorization level of application α to normal permissions, and application α is adjusted to a public application.

5. The method for authorizing an industrial computer application based on an Android system according to claim 4, characterized in that: Obtain the change data of the application authorization level in real time and mark the application as abnormal based on the change data of the application authorization level; Adjustments to the authorization level of applications that have been flagged for exceptions include: Obtain the change data of the authorization level of each application in real time, and initially set the authorization points of each application to 0; when the authorization level of any public application α is adjusted from ordinary permission to dangerous permission, the authorization points of public application α are increased by 1; when the existence of any regular authorization program β changes, the authorization points of regular authorization program β are increased by 1; Whenever the real-time acquisition time of the authorization level change data of an application is greater than T, the application with the maximum authorization points and an authorization point greater than 0 is marked as an abnormal fluctuation program, and the real-time acquisition time of the authorization level change data of the application is reset; The authorization level of the abnormal fluctuation program is set to privileged authority, the abnormal fluctuation program is adjusted to an administrator-authorized program, and the administrator monitors the access status of the abnormal fluctuation program in real time.

6. An Android-based industrial computer application authorization system, used to implement the Android-based industrial computer application authorization method according to any one of claims 1 to 5, characterized in that: Including authorization initialization module, authorization status analysis module and authorization adjustment module; The initial authorization module is used to obtain applications in the industrial computer and preliminarily classify the applications based on the application access settings and administrator settings; and set the authorization level for the preliminarily classified applications based on the Android system; The authorization status analysis module is used to monitor applications with set authorization levels in real time, record the data obtained from real-time monitoring as real-time monitoring data, and mark public applications based on the real-time monitoring data; Adjust the authorization level of marked public applications based on the Android system; The authorization adjustment module is used to obtain the change data of the authorization level of the application in real time and mark the application as abnormal based on the change data of the authorization level of the application; Adjust the authorization level of applications that have been flagged for exceptions.

Images